Bitwarden vulnerabilities
We track 7 vulnerabilities in Bitwarden products across 5 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 29, 2026.
Latest Bitwarden vulnerabilities
- 7.5 High severity
bitwarden server: Incorrect Implementation of Authentication Algorithm
Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQ
- 8.0 High severity
server: Authorization Bypass Through User-Controlled Key
Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token b
- 7.1 High severity
server: Missing Authorization
Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove
- 8.1 High severity
server: Incorrect Implementation of Authentication Algorithm
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
- 9.1 Critical severity
server: Missing Authorization
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target o
- 9.8 Critical severity
Bitwarden CLI: Improper Control of Generation of Code
Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident.
- 7.1 High severity
Bitwarden: Cleartext Storage of Sensitive Information
Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.